The product contains an assert() or similar statement that can
be triggered by an attacker, which leads to an application exit or other
behavior that is more severe than necessary.
Extended Description
For example, if a server handles multiple simultaneous connections, and an
assert() occurs in one single connection that causes all other connections
to be dropped, this is a reachable assertion that leads to a denial of
service.
Time of Introduction
Implementation
Demonstrative Examples
Example 1
In the excerpt below, an AssertionError (an unchecked exception) is
thrown if the user hasn't entered an email address in an HTML
form.
Chain: security monitoring product has an
off-by-one error that leads to unexpected length values, triggering an
assertion.
Potential Mitigations
Phase
Description
Make sensitive open/close operation non reachable by directly
user-controlled data (e.g. open/close resources)
Perform input validation on user data.
Other Notes
While assertion is good for catching logic errors and reducing the chances
of reaching more serious vulnerability conditions, it can still lead to a
denial of service if the relevant code can be triggered by an attacker, and
if the scope of the assert() extends beyond the attacker's own
session.
Weakness Ordinalities
Ordinality
Description
Resultant
(where the
weakness is typically related to the presence of some other
weaknesses)
Description
